OpenAPI Security Contract Lint

Runs the same checker as our npm package on a Node.js runtime that pip installs for you (nodejs-wheel-binaries) - no system Node.js needed. Your files are checked locally.

Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.

Install

openapi-security-contract-lint file

Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.

Free

• Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld
• --rules lists every rule

With a licence ($29 once)

• Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence

openapi-security-contract-lint --dir ./templates --report html --out report.html

An application-security consultant reading the same contract by hand bills $150-$250 an hour

Use from an AI agent (MCP)

Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:

{ "mcpServers": { "openapi-security-contract-lint": { "command": "openapi-security-contract-lint", "args": ["--mcp"] } } }

Tools: check_text and check_file (free) · check_dir (licence). The agent gets every finding with the line number.

Use in CI

- name: OpenAPI Security Contract Lint
  run: pip install rulestamp-openapi-security-contract-lint && openapi-security-contract-lint --dir . --ci

The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set READYSTACK_LICENSE=<key> or run --license <key> once.

Get a licence

Install (PyPI)

pip install rulestamp-openapi-security-contract-lint
openapi-security-contract-lint --help